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EXAMINER'S AMENDMENT 
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tOm -uJa V-tW<\1> A, i.omra^r ptog"drr prodiuet n * t-otnput*?? 
nedrum ^QTrtrnMnK s computer ts v pershc * (. »<rt mI w <->mput*r v (k ect a 
•CVrtr i.Ct'-put^ orOg^Ym Vith* & x sckcGi rpp" tcrtrL i pic*- ^o" srufc.''' *v ij 

rescmrcc &v? rrirhiu vnc for xeachrt. ^curcc eta wthm ^nJ ^ icked empire? 
f ia T e o rce a tta ^pecm 11% p^gram re^oiir^e n«r nxd in s^id 1 aic* , vn tomuter 
j jfr-nrr r*i< tu iah ^ \ ^ jputi.r t per *tr 3 «*\\f€«r \ iihas t sVTtroi ncc iipr* V 1 h 

esturte din t-ompju a h "> e fa* within* Jur vIl^u^ cf c„_hk s_ da * 

UilpUTl iWH, itT> tt< ht ^rJ \ *3 t^tfm^v sMtfc^i^^ Hi ^ s v tit" 
program liadieativ« of said packed computer file coaislnmg mid known mmpwez 
program; 

wherein said resource, data of said packed computer file is processed to generate 
fmgerpttM data as id to uompaie said generated fiagerprinl data with koowR comparer 

program Bngtrpdat 

wherein said fingerprint data iusluies a number of ptegu^m resoia^e 

itotsJ specified withis a*id resource d ; .t& of said packed computer file; 

wherein md genemed tkgwrprim &u ixtdudks » Hsm iMctiUng vyJ&U <kk i* 
Included witMs said guMttwt flags*p3rim data; 

vv'vun ^ml gctvtved fm^rp-mt dan rnemdvo v l< c»u»«n within o«?d revurvt 
Jam of saif 5 packf i on'putct file of entry specifying a program r«owce item having a 
largess size; 

whudn said g*n«a;ed fhgerprrat data includes & e-hscksiim vslus calc\ilat«4 ia 
• k™cndcrsco upoii' 

Ti mmi^i 1. 1 sail pug 1 am icsuui 's* strais s?*c3tifd lieneith 'ichiidr iMthsa 

hicrarchicalh aimged nsema d^ta sxd uacked ccunpu^ s?L, 

SDi^s names ^sr-c.at.d v^th cs,;d progrsi* 1 tesou^v % tvms wrhh ^a:d iyx^jih. 
date at <uid packed computer file, aad 
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id <*hl pa«^suii icwurw nwns within s*t*3 jysoujce data of^id fucked 
computer Msi 

wbe^iO s aid chcc1f3um Mi'ic «g retaftj each itrm,l»«w ^JJd bk< »aiJ 

? Ongr fl i i c im,-suter program p-m ct as ciainec dam ! <\Ki n i jiU 
kiKnv* counter to > e * ot 

alrGian commjter program: aaa 
a wopa ctasjpoter program, 

> fi reviCv.'sl) Pn^n*ed \ co^pisk** jvYvgn i p och ct \s f 1 ed in d tsa * 

*>3iti paJ„s.d t >* ipute £k v tfi ehd. ^ettn ftov \,t a pL all \ e! ku-onii tomput-r p^gfari* 
Jktwt jf said pavKw J ^uipite file v.c Wsvm, o ^ H«*aliu of ktk^v ,u -*iput^ 

4. fCa&cfttled) 

p oKiai rc^.*u »e iai ^db\ mjuII t^v"? t^ita*-* nckde ~w o ceo* 

strmg data: 
dialog, data: 
bitmap data; 
me&u cte; and 
fengttagfc aara. 

v-r^i a d lew cc data t 4 d jucketl vamp,. r v i c sj „c Lc*. t*. r cad rv? <u ^ ttcn ^ 
Storage location of said resource item .. 
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" lOn^iail) A computet psugiam ^daU ^ vlxumed in cUm 4 "Jbuxm &aii3 
sluragc ktanon ei &jid i<** w >jxc* item ih ♦-pedikd as an i^klht, yifce:. \ alue. 

win eii v^J iei.od.LC d 3. d paiA^d Ltxiipsi,.^ r k s.pa.r^ev **Lt t tumour . wna 

$m of said resoeis* item, 
9.-11. (Ca&eeJted) 

12. i?t*\kmi\> Psr^mUs A computer program po4uct as claimed w ?Mm L 
uiiereui *aia generated frngerpimi da*a include nm^tamp data mdie^ttne ot a ol 

13, (G^oelM) 
14,. (Cm^kS) 

l"> ik n<n^&,s \ cwpTcttt pro^^np odikt w c 1 nmw* tic am i cretn ■njd 
ncl d or- x t *• il t inci de« mining on pi ter prognni vdixj i p^n i^sa ~ion 
deeonipiesses said knows, computer program^ 

lo (< >t«anih ^. tompulu program p udiut Jamua m >. a t 1 wfvtc j u^d 
packed computer file is a Win32 PE file. 

1" ^Luiruath V* ers Ld, A v.^iaa^r ptD^om paodiii. i f 1 ^wpik Mii^g 
mud am i_omjL ii^wl^i pii >r3ii ijx.t.d l t *.ot t £>i a h mj A < ? no «l ^4 3 

for defecting & kfu>\VB computes: p^^xjim vuttda a pack«J computer file &a*4 pa* k*d 
computer ilk* bsing unpacked upon t^eeimosi, said coiupv^i- program ccmpnang 

resource damtmding logic ffer reading resaimie data within asud fucked computet 
file, said resource data specifying program iftsaum.es items used by $ jid <eiowii ttsnpmer 
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^ f*grm 4 W iftad -Mr ^ a compute up^rj m« *\us?xi ^rh^m d*,»2Pde»e« utttm H Jitih 
ujejpu king .i\>o.ruhm is ueed b\ b*ui p^ktd corrpuwi He xtA 

c:uaaE«iaie ^ta^ra^ii^ logic toi ^eoisg c uiaceriav. a&» a\me ae I 

vuth >wd e%>u c£ diLi >>» u «TTp in v *■> v. tt\ ch ti*t t ^Lut fin. ^ of bxw. ji ^poter 
pro^u^ti L%t wk o aau ti? ievs t a roa \ aid kxjowa v^n^pum 'm> j^H-ru ntltcam e 
*aid packed eompu ale eoitunwg «t*c vr» vompotct p*o$* 

v x k n said ivwuruc <~pn v. i vaid &e I oirt| ^tet tde* ^ " ^ -"^rd. v ^-n-t 

©tokpshi feaerpont data; 

\\hue<^ Nt ad £?iv& T^d ti j«<?irn n dakt in*. ikIcj ^ nutrhct of ptogtam 'cr *ec 
.tet^i xm^ie^ \s tb^n <\ul ^sou l« data nr rwki*d eomnnrt"- 1 s1 e 

'nc'udu 1 v irlr n >axd weru'ed >gerpn?r toi 

em "aid ^rerstei t nge'pirt tn*a tnohfd.^ k. lotilwi witn n seid revise 

N\hewtt *4id gene-rated fugef o dan mdadL 1 ^ a rtt*ckNum \ilu, ca c Jatvd m 
4«pendenc« upon: 

* tinrX 1 or ^ rg^ara ^^ouic ^p^ ^rfied lt>n>ath &&>^ ^ de within 
H tfiaixlii^ 1\ dir\i^ed ^\«iLff\'« Jiti' o i did packed '^"vmputt-r file 

trag njLmes a* iociat^d wtb pri>_rjis Dusour^ ilsm. Mihin raid "trMiree data ot 
said pacfed coapto tils: and 

v tes i>f i«i 1- imi^m - i-mi uL^a^d ^^u"^ J«.uof swjdp sk^dt.* ja*>M.*e* 

nic. 

v hwrv-a .aid cKc^m^i \& ue i^imt^to&isM^^^^ tUdtd «itw ^sg 

!a Ontnntl' \m ijvuei pjoar^u ^ f «^t ^ ^^imftdn^ku^ 1 <, Miemn^ud 
kjitowa computer program is aueoft 

a TrojM computer program; and 
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1 9 (Previously Presented) A computer program product as claimed in claim 1 7, 
whereia said characteristic generating logrt is operable to geneiaie characteristic 

data tram a plurality ftfVm>wn computer programs to enable detection of my of *aid 
plurality ofkaowa computer programs within said gnc&Kl computer Hk, 

20. (Cmeciled) 

21, (Oridnal* A compmex pro&ram product as claims J m claim I whs rein 
program terowce t«eiru? used by ,>aid kriO"m computer program m^Ui^e m? or rafln? of: 

toon 

simig dam; 
dialog data, 

trenr dara, ;*n1 
tanuu aau 

^.2 0 te\Mi<slv Ptoscntcd) A commute prop am product ^airatd jn^aim 1 s 
wbcfytn. s k source d a of s^d tscicd computer rile spec ties ror e*ach rest tirr* 'tern 3 
storage locatkEs or $md zvmuzw item, 

.3 (t) iginal i A cot ipntei ptag daei as claimed m ciaim J, \*he un said 

stOiag* Jyt tiva said tesouit*? item is s^ut^M a* oil rebm : offset 

wherein oatee daia ot j acked ui? jputsr Lie ^peatie^ t^r e^oh i«ouiC£ <tcsn a 
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2S (Picn ijusl> Predated"* A comwter woudin pioduci ^ clsim^d uj P, 
win»*nr. generjinsd ilntetpHni dan melody tnnfcstasnp data breath l of n tine of 
eonspite n ol *aid fcn&vm cat%utc program 

29. (Cancelled) 

30. (Cancelled) 

M ^ " g >*) h »*puer tPA'ai" prtx»uvt *k d^w. 4 cbil *\h*tan& td 

' * & A, <: v*"pne pro<? ^ pallet ^ n^raxv dtp t , \ ft<?t? n sid 
p^xi-ea enrputet fi e i r% ^ tile 

Cv, tputei f v'gTAti v rh i a ^aok J con p"U ^ said p. d"d c mpr eri le brns. 
imp. kca pan t \*.cuiie m, id v^ot* eo ipr^in te tl s stvps oi 

r> &dL g it - net * Tt *, 111!* <? ^ p eb 1 wja te ^1 c <: id 1 s iTi Alt 
speufjmg ^jt^an reayurc^ item^ us,ed b\ &4ltl Xnyun computer progULm and jvadabla 
by a cempursT opssarsnj! SxS'em without depend«ace iqsor which unmaking algorithm is 
iised bY said packed computer tiie; sad 

^eissiat-n^ ~h*i attends <_£ i,md i source daia ^nd N -Lmpd2iii^ s«a.il eh^t» tensties 
yi SiAi J iv^tiivt? d^U \Mth thiTACtoiiiU^^ of Iuwm CJmpyiCi p y^nun rajou* ^t* -^ata and 
dealing, e. m itch uith character!} "cs >t aaud k&>wn camputsr pyogmm indieam e of said 
packed LOffif-uter file 4.-ostaaai% &tttd known ecjmpuiei pogrom; 

»\b?r«-i» &fc'J se^ousee d^in. o^asul pfc.vk.aJ c? mpu'et Ilk & ps\xes>.sei to g -titrate 
fmg^ppxtt d<*ta to campAiv g4?a^y.l^ J^U with kno\ -a camper 

where n sasd pen r&ted f ngerpnt t via,a i iclndes a m pber of pn^pratr resauice 
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wherein s&sd generated fingerprijit dais includes t flag iadiesuag which dam $3 



wherein sa'd generated imgferpj at data includes a location with'm Wtti st^notue 
data »i' ^aid packed computer fits of mi eurtrj spsciryiug. a pxugi&ra t^Ourw itmi having a 

largest siz&; 

wherein asdd gensiatad Smgerprint data includes a eh^ksum \#ue <&Jcui8tcd k 
dependence rapoai 

a tuxntWv yfpiv>gmi.u icswwrc- ketm sp^afis-d beneath each r<tKk whMn 
ruer^bfcaUv swni&ged resource dma. of said packed coaapuraf file, 

string rame-s associated with program resource itc is within sa^ resource data or 
said packed computer file: md 

skes of program »wce item* within said resowc? data of said packed computer 

lite: 

wfr&rcm said chgeksam value ia rotated between each item being added into said 

34. (Origins!) A method as claimed m cMm 33 ? wherein said known, compttter 
program is one of; 

a Trojan computer program: and 
a wosn computes? program, 

J5, ^Previously Presented) A roettodax claimed in dmm whH&m sstrI step of 
comparing compares said resource dauof said packed computer file with, cliaractenstics 
uf spk-aiity of known compute programs to dew if said packed computer file contains 
one of said plurality oftemvm computer programs,. 

3& (Cancelled} 

37. (Original) A method as «Mmcd in {Mm 33, wherein said program ffiffisw 
items used by said known eotsputef program include rwe fir retw of: 




term data; 
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ttjaiog oats; 
bitmap dais: 
menu dais: ma 

(Pn.\!t idy P^^eutcl) A 3 xthod ^ ddtmeo i tkia \ theft* a a 

iex&taxa oi saw x«swui«« item, 

^9 { "> s i * ^ ax dm iKd m clsi is « heron * <t >r*g? he tif t ol 
vtk t ie un. i i » <s\*h<?i a* *f o taei i .. be 

r«*»i *n * 1* n-t id f i k>?d 1 t tr" V spR net kis cn^r fj f itr*to \ k«t" \ vid 
m^yiv* Item. 

44. (Previously Presented) A method as dalmed in. uhnm 33 } wherein said 
gmented fingerprint d\tt itidud^ pmesrarop dai&indicdtivf* a time <rf compilation of 
said known computer pfopara. 

45. fCtmedled) 

46, (Cancelled? 

47, (Od|iuial) A nuetliod as claimed m iLdru 33 v* Harda pitikei compute 

file includes zxt unpacking computer ptag-am which ujw,. e\eeuta^ideeosmp*^se;* 
known computer program, 
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4R (0)%bid) A sueitioi as damied in claim 33< whsiein said paclked eompffl^r 
!ifeiiaWM2 PBffis, 

*■> t ( ' T^mt * 4nf vied j A nerl >iU*iy\t ^Pm^ 4. vu j <r li jt L<-tL i\ 
J*- w. * j/ *> k t* m ti w-nfH ! er p o«rsri \ xth nsci I c-omp Ik , »a d Tj&cked 
u trjfa -«r Hei 5 o.^* eked ipa , e v ci l or, "aid mefe*. 1 c» np r i£ tat steps et 

ft?td iJ^arc-da^n t " d p c^<*d oki} h°i *k xvsou-l * a 
*p- i£> ixz pjx, sja^ii Uv^' An \& uivU b> ^ d **i i i?u,o t v, 4115 4&d rwd 

ussd m said Bacfc&a eompui&f nl%-i mi& 

with tliai d*ta oi La<»w 1 v l. ^uur- j> j^ram i^^v 1 ^^ t3 U xid detstt 11 amjth 

v, d fcaid L wn <k.mT>ute p < a aa* jm no md p>tked is rsputt ~L tjttt^i 
mdkfcott eo^pt^L prc^i&n 

\\K <■ x i * si<) n> (1a t * ^*ttl 1 ^ke-d tun s j us Musviji >*i > ^ 
tux a?prm daU <*i d <,n iip^re s*si J t,-n«L - at d iin^ cilu <?jm s\ ti~ ' cott pu £ 

' v-x *l v^^h r > '1 ^e^jree -i of «?a d *^ cie i <„m ut^r fda 

t ?i „mt pe ^ared i -vtprort cr. aj cl«de? a *1 g: r d^c-a v P" 1 \->Hz \ \m< s 
t*-v s t ^ «t!iT it d geaeu ted t iige ^ n a 

u N v re^« <?nd nf+ T*^ ijf^p t sat ^ 1 idrs a k ^ w ti n ^fud n t 

v he eir .'d pasted tiBgerpn-t A f trciwk* a checksum -aluc t ile Jatcd 1 
depeasdenoe upon : 

h e'srtx e Ih ^"rs " r ^^ t da* 0^ jacked ote " i^fik 

string names associated with program resoorce within said rea&uree data of 
said packed campntsr ftjg; and 
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ft k eir cKvk-rm v ie -o^ied I e>u^:, e^s item t^ing ^>ea ,iu .oid 

->0 (0* gt»r \ nr^tHad ~* c ,. ut e3 ir clojui v. he* c known co rpt tsr 
program is «ue of: 

a Troj^sn r.ompoter program; &rd 
wjrm compute program. 

51. (Previously Presented) A mesiuxt as claimed if dsim <R herein said step of 

geaeratiaig generates sshamct^ktic data fiom a pLsialin <_f Luowl. c^mpirtei piopafttn:* t - * 
enable detection of any of &aid plurality of knewi compute pso^^s vviihia ^id packed 
computer file. 

52. £ Cancelled) 

S3 tCmtfuxu a rothod o& c'uiravJ ia dum 4°, Mm*m ^ pmgram resource 

by kmnvn computet prog &m \nz\u36 >ne u* more oi 
icon data; 
string dm; 
dialog <ta: 

bitmap d&ta; 
mmu data; Mtd 
tapage data. 

*•> I OP c uhv!> fVtentrd'i * mHW as i ta red ir ^ la* ^ a v be- tr- ^std 
"PS-CUT** 4 At 01 d p.* ked u mj% « <*p«\ k^ ot cat.! ic^u. » c acu a f*vOt*ge 
locatum oi said resoisse item. 
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5„S. sXHigUifd) A sneikxi <w claimed m claim 34. therein said storage location of 
said resource itsin i$ specified as an relative nffset value. 

.56. {Previously Presumed) A su^tbuJ & claimed in claim 49 wherein said 
tesou^c sl-a<s of xsid packed computer nle sp^eife for each resource iiim a sise of said 
resource item, 

57 -.-59, (Cancelled) 

f*0 (Previous!? Presented* A method as claimed in claim 4b\ ^toem .«id 
generated nngtspnttt data n ctsidt^ timestHfttp iwhf a ive of a time of eon $i lit ion o N 
said known, computer program. 

61, (OmcelM} 

62, (Caucdfcd) 

o (Cn^-ri A i<*e*l i -d da clai usd * 'a n 49 x here a ^itlpa ^ i ^pirtrr 
*?L itv i i\ ,Tif s Vit*^ n i| 1 ft !J"Atn ^\<.K o i^n exetritt* r der.^mi re*Ke*t s^d 

t*4 ^Urysjil^ * T xth<i *t\ti« r*iJ,.um4^ w ^eci^aii picked ro ipue 

&5. ^Cuawrttl* Af&ewSed,, Apparatus for detecting a known computer program 
vithw . psckrd cw pi Vr tile, ^std packed corapnrrr tU<? being impacted npfn exfastsoo 
sa!4 apparatus c«iBpfkiiig: 

a rvsoiirce d.ttsi jeade? few reading resource dat? within said packed computer lite, 
said resource dsta specify Bg p x>gram source items used b> s&id ' nmvn coi iputer 
piOgraro and readable hv a computer operating •'wtem v. ithotit d^r.dmcr upon which 
unpacking aigcidur 's used ! >y saiU pavked s.ompuici Ilk. «ukl 
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ev. * \f d t<a toti p«ir ur to jiene-srs p cha ^ten^tc of ^k! re^ c«s,*d vt?o 
to u in 3 jr «d vha at e t Cv u + k d rvcn » -e data wtt 1 i cH -r v ~U ^ ot \$ owi 
^ urpu\r |"\ j-^m ^ouk * dat to 1^er t o => * ^tth < *d ^ * vrr^putc"- 

*n nere n i<w tun u ts of •% id p< c .dv i T p«te file \3 process, to ca c 
* n^T>u t a^ta ai d o iif|i d f i ir^erpi r J t iv ^ ^tiov\n c i 4 me 

program imgei'pms: data: 

wharein \u1 ^tk. jf*d t ao-pt. ^ dm clmtes a nu ibes **f jaowa, rssvu <3 
nsri* ^p^vili^d Jim "sii re^urc*. a&ta c ^id $<^s.ed <. ompu\*r *ik t 

mciiided mikw mvi peuesccecl feisier pnat oats; 

U ^t^itt^d Jlagt w x>t4 raciudut t lo^dfi v\ tii» Laid r^mu. 

largest sxss; 

wVmi* 1 ^ K?i li eT">ir d<*u riUiJt, 1 ' a t/nxkwa* v due ual vtlat- i m 
dei^Mg»ee upon: 

, a ib* t c> pr< ^faM rwomxs, tens „*pcciiicd k;*n\ith cadi rode -withro 
i etWs tall y an i p.ed oo u j '* *» * *t & ai I packed computer file, 

of pTi£ f v -eh \ thm ^id tpwtmf d tta nf said pacV^ f ^rrptitrr 

ilk; 

Hhds? n -K"* die^kMin 1 ^ v ^ m t& * etH«n h item ^ftiy adi^d mto ^^d 

6. (On^i m! i A.f p 4fdi ts cldit ted 'n claim ^S s wkerdn said known computer 
^ r <? of 

k re* 31* iv.uterpx>g^n , at 1 
a \i i computer p\s[t m 
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tPrr* "omly Pit^euldh Apparatus as cMm^il in claim £5, vhordu sai 1 
resource Jaul oyaqxsrawi is operjblt -_e compare saki rwotifOG data c<i said } &d c.1 
computer file wth ehsiacter ties of a plur&M) oi known computer p^ms to Jdeei if 
^aid packed compote si c cr* i a-tss t or^ t>f *wtt? p!t s > ltt> i lflnown «. ^mpytef. prouwins, 

69 (Origin*!) Aps&tms as dmu-d k claim 65 ? wfcstswa said pr»jpsmj«sour«e 
iteais w$ed b> said known computer program include <me or more of: 

ftrmg data; 
dialog dam: 
"bitmap dam; 

Imgmgt data, 

70 (Previously Prssentg-d! Apparel as claimed m vlaim whstem said 
resource dsm of said packed computet ti'e specifies to eac> ic^ur^ itcn a ^tnrage 1 
location of ssid resource item 

7L f Original) Apparatus, as, tlarad m claim whvtetn „ k vatieno* 

s&jd resonree item ^ spoutjed i an Mame it) a^'s: 

resource data of said pt^KvJ ^.oinpuLi flL -.p^if^ ior rt-u jr . i a\ a ma * . 
resource item. 



73.-71 fCancdtetfV 
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"7> (IVcruous^ P«eitufU x Apparulu» ^ v.lii»ivd ia v <dm 6^ nheican -tid 
t,*-itf . ^ iri^r.am lau mdtid tn*&~Uio^ data ^dieatn e ^* a t }f c^mplitior 
said known compter prftgram. 

78, (Cancelled) 

, a . tOiifdiiai) Apparatus a;* olaim^ in clans t$ s> *U packed iomp^r 

tie sa "lufe *n unpacking ivnipater program wtach upon e^eetifkw decompresses 
texmm eamjmte* pmgtnm. 

StX iQrigia&l) Apparatus as claimed is claim 65 < whsreis said packed computer 
fiteUa Win^FH fiie. 

SI. (iSuOTiiiiy Amencfed) Apparatus lyi gsisgrsting d»i» Cm detecting a known 
computer pjogram within a packed computer tlk, said packed computer iiLe be"% 
uir-acW t>po i ctecnEim apparatus comj-rsm£ 

^ r?s« urce tbu 1 re^Jrr t>^ ivsihr" re^uro H<ata within ^ik! fit t ^m^itter riU> 
>„ud r^gt'Kt» dt*\ iwahin^ p-ivjr,sna resource item? ascd by sskl known icunjl*: 
proenxn snd readable b> a. computer ^raring syn^m without dependence up^n winch 
utip&.mg idgoiitam is tistd b* &aid packed coniputer Uk, m<i 

a eliataeteiistit dati generator f.i usuitiug ohaiitereiisiic ia^a i^soci^teJ <*itU 
tatd lciourcc daw k t eorupariR 11 \ <n\h Cjiaractenstk -d^ia of kn j ,va compter program 
rciuufi,^ djta and for des^&ag a match with smd knov\n wonvoutct piogiam mJic*u\ c o; 
•-aid pa»A£;.J vomputer f^e obtain 'rcf &n«s\ m ronrtpiw** r prv\jrwi„ 

v^k'txk old je^ousue dW ofVld ^cked compel fsk i& ps^^s^d tn g«,\wr»W 
fln^rwm dyu and ta compaic ?«ttd Rwusuted tln^rplnt data vith known cc-tuputcr 
program fiageipmt data* 

w (Matin ml generated fiEgeipnit data includes a trartbet ot program "^nree 
i^n i> -p*rs *fi*d vutlur -a* J iesouK.tr dtra if^^d p^oUd »,«'mputsr illf, 
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wivrifin Svud getiemisd fmg rprint dsta includes a tUg indicating whscfa data \s 
mJiaJe.j w| hin ss;4 genemed liug«j riot d^u; 

wber^n siid generated fingerprint dafcmchides ? Iranian within issomes 

aafa ol scud n<.Kkui cdn } ute*? tlk n+ an entry specifying a proyr.rn r^auie^ itei» h&\iis£ a 
largest uuk. 

wtwxein said ge scared iinw.rpnnt data ?tjc! ides a checksum \ Hue calculated in 
dependence upon: 

a ^ miter of progixu ie scarce h?m& ^pccuieJ ben^aiit T»©d© within 
iLci^hfc^lH ^n^n^U fsjsouks data o 'said packed compu. sr nle, 

sn'n^ name- 1- associated with prograa resource items within ^aid re^wce date oi 
said packed mmpti&t tile; and 

sizes uf ]. lu^-am sesouae items within said icsyurea dgiy. of said pxked computer 

rile; 

whtrds 

Zl.\i rijnnal* A\^mm ~s chimed in Si, therein said knowa compter 
program is mc of: 

a Trojan computer jjropam; and 
a worn computer xmmsm, 

U revio isly Pre. teds App^tas as tlairord w ctam SI , whnein Mid 
dv^^neusiu «Uu geucmu k operdbk io genwaie ekeraewmsk data from a plurality of 
known wmpyu.T proununv to enable detection vf* am' of said plurality cf kno^vrs 
computer programs withi * mid packed computer file, 

8?. i Original! Apparatus as cb xned m claim 8L whet em said ptogr&i i "eso-jrex. 

item* me* by said known ca tpoter p r>grsm in^hjde one or more of 
icon data: 
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string data; 

bmsm data: 
menu &m; and 
I&sguapse data. 

85 |I ouJv PfviSvfto) Apt) -utita a, dd*i ted m ^j&t i dl whe c r ->ud 

ST fUngi iah 1 f sua u=s as e"ii«ntsJ ituh ^t? i <ntd ^agr looitK * <t 

m i-S tfv nut? r tr«n is s JVO »m< jck \ - ^ :>ct \ -iw- 

ok UyArr«uieJ Yspom trclo? "tan claim S Vietrm ^nm. 
data ot d -'kcd conptitc- ftk ^-ti^ts^ f "v c ?e~t v fee ¥m «"\ ^g-? kx *t*Q * 
mid iesouioe limi 

89.-91 , (CaiKdkd) 

92, (PrewiuLSbly PfttSttiiScd) Apparatus sis claimed m dsum $1, wherdis K'dd 
ge-neraiM ftagerpr its data includes Hmesiamp dm indicative of a time of compilation of 
said kmsm eoniputer program. 

94. (Cfsaceiled) 

93 . ^Original )■ Apparatus as claimed in. claim S 1 , wfaesda said packed compaier 
$1$ msM^g an usp^cklas tot^wr program which apoa ejuscuson Compresses said 
kmwn computer program. 
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*Jt> fCVejinaU ApjviAtws as claimed mtUim SI wherein £*ih1 packeJ compui^r 
file is a Win32 PS file. 

. 91. (fim^am 

98. {Curr^titlv Am*?»d*?d) A computer program product $.$ claimed in £Mm 
vtetin ssid checksum value is rotated I bit to the left. 

Allowable Subject Matter 

The following is an examiner's statement of reasons for allowance: The prior art does not 
provide teaching or suggestion of the inventive features in the combination as claimed, including 
generation of fingerprint data for packed computer files, wherein the fingerprint data includes a 
number of resource items specified within the resource data, a flag indicating which data is 
included within the fingerprint data, a location within said resource data of said packed computer 
file of an entry specifying a program resource item having a largest size, and a checksum value 
calculated in dependence upon a number of program resource items specified beneath each node 
within hierarchically arranged resource data, string names associated with the program resource 
items, and sizes of the program resource items, wherein the checksum value is rotated between 
each item being added into said checksum. While many of these claim features were, by 
themselves, common in the art at the time of invention, there is no teaching or suggestion in the 
prior to combine these features in the specific manner as claimed. 
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Any comments considered necessary by applicant must be submitted no later than the 
payment of the issue fee and, to avoid processing delays, should preferably accompany the issue 
fee. Such submissions should be clearly labeled "Comments on Statement of Reasons for 
Allowance." 

Conclusion 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to MATTHEW T. HENNING whose telephone number is 
(571)272-3790. The examiner can normally be reached on M-F 8-4. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ayaz Sheikh can be reached on (571) 272-3795. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would 
like assistance from a USPTO Customer Service Representative or access to the automated 
information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

/Matthew T Henning/ 
Art Unit 2131 
/Ayaz R. Sheikh/ 
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